douyin-viral-script
Fail
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: CRITICALREMOTE_CODE_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- REMOTE_CODE_EXECUTION (CRITICAL): The install.sh script executes remote code using curl piped to sh and bash process substitution from astral.sh and an untrusted GitHub repository (alchaincyf). This allows for arbitrary command execution on the host machine during installation.
- CREDENTIALS_UNSAFE (HIGH): The download_douyin.py script accesses sensitive browser cookies using yt-dlp's --cookies-from-browser flag, which exposes user authentication tokens to the script and potentially to external processes.
- EXTERNAL_DOWNLOADS (MEDIUM): The installation process downloads various tools and scripts from non-whitelisted external domains.
- PROMPT_INJECTION (LOW): The analyze_video.py script processes untrusted video data, creating a risk of indirect prompt injection. [Ingestion points]: analyze_video.py (lines 120-180) via GenAI API. [Boundary markers]: Absent. [Capability inventory]: Script analyzes video and returns textual results to the agent context. [Sanitization]: Absent.
Recommendations
- HIGH: Downloads and executes remote code from: https://astral.sh/uv/install.sh, https://raw.githubusercontent.com/alchaincyf/Write-Prompt/master/.claude/skills/douyin-viral-script/install.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata